Changeset 95620 in vbox

Timestamp:

Jul 13, 2022 2:12:55 PM (2 years ago)

Author:

vboxsync

Message:

IPRT/RTCrPkcs7SimpleSignSignedData: Allow RTCR_PKCS9_ID_CONTENT_TYPE_OID in the pAdditionalAuthenticatedAttribs parameter. bugref:8691

File:

• trunk/src/VBox/Runtime/common/crypto/pkcs7-sign.cpp (modified) (3 diffs)

trunk/src/VBox/Runtime/common/crypto/pkcs7-sign.cpp

@@ -32 +32 @@
 #include <iprt/crypto/pkcs7.h>
 
-#include <iprt/errcore.h>
+#include <iprt/err.h>
 #include <iprt/string.h>
 #include <iprt/crypto/digest.h>
@@ -138 +138 @@
                      * Do the signing.
                      */
+                    /* Create a ContentInfo we can modify using CMS_sign w/ CMS_PARTIAL. */
                     unsigned int fOsslSign = CMS_BINARY | CMS_PARTIAL;
                     if (fFlags & RTCRPKCS7SIGN_SD_F_DEATCHED)
@@ -146 +147 @@
                     if (pCms != NULL)
                     {
-                        CMS_SignerInfo *pSignerInfo = CMS_add1_signer(pCms, pOsslSigner, pEvpPrivateKey, pEvpMd, fOsslSign);
-                        if (pSignerInfo)
+                        /* Set encapsulated content type if present in the auth attribs. */
+                        uint32_t iAuthAttrSkip = UINT32_MAX;
+                        for (uint32_t i = 0; i < pAdditionalAuthenticatedAttribs->cItems && RT_SUCCESS(rc); i++)
                         {
-                            if (pAdditionalAuthenticatedAttribs)
-                                for (uint32_t i = 0; i < pAdditionalAuthenticatedAttribs->cItems && RT_SUCCESS(rc); i++)
+                            PCRTCRPKCS7ATTRIBUTE pAttrib = pAdditionalAuthenticatedAttribs->papItems[i];
+                            if (   pAttrib->enmType == RTCRPKCS7ATTRIBUTETYPE_OBJ_IDS
+                                && RTAsn1ObjId_CompareWithString(&pAttrib->Type, RTCR_PKCS9_ID_CONTENT_TYPE_OID) == 0)
+                            {
+                                AssertBreakStmt(pAttrib->uValues.pObjIds && pAttrib->uValues.pObjIds->cItems == 1,
+                                                rc = VERR_INTERNAL_ERROR_3);
+                                PCRTASN1OBJID pObjId     = pAttrib->uValues.pObjIds->papItems[0];
+                                ASN1_OBJECT  *pOsslObjId = OBJ_txt2obj(pObjId->szObjId, 0 /*no_name*/);
+                                if (pOsslObjId)
                                 {
-                                    PCRTCRPKCS7ATTRIBUTE pAttrib = pAdditionalAuthenticatedAttribs->papItems[i];
-                                    X509_ATTRIBUTE *pOsslAttrib;
-                                    rc = rtCrOpenSslConvertPkcs7Attribute((void **)&pOsslAttrib, pAttrib, pErrInfo);
-                                    if (RT_SUCCESS(rc))
+                                    rc = CMS_set1_eContentType(pCms, pOsslObjId);
+                                    ASN1_OBJECT_free(pOsslObjId);
+                                    if (rc < 0)
+                                        rc = RTErrInfoSetF(pErrInfo, VERR_CR_PKIX_GENERIC_ERROR,
+                                                           "CMS_set1_eContentType(%s)", pObjId->szObjId);
+                                }
+                                else
+                                    rc = RTErrInfoSet(pErrInfo, VERR_NO_MEMORY, "OBJ_txt2obj");
+
+                                iAuthAttrSkip = i;
+                                break;
+                            }
+                        }
+                        if (RT_SUCCESS(rc))
+                        {
+                            /* Add a signer. */
+                            CMS_SignerInfo *pSignerInfo = CMS_add1_signer(pCms, pOsslSigner, pEvpPrivateKey, pEvpMd, fOsslSign);
+                            if (pSignerInfo)
+                            {
+                                /* Add additional attributes, skipping the content type found above. */
+                                if (pAdditionalAuthenticatedAttribs)
+                                    for (uint32_t i = 0; i < pAdditionalAuthenticatedAttribs->cItems && RT_SUCCESS(rc); i++)
+                                        if (i != iAuthAttrSkip)
+                                        {
+                                            PCRTCRPKCS7ATTRIBUTE pAttrib = pAdditionalAuthenticatedAttribs->papItems[i];
+                                            X509_ATTRIBUTE *pOsslAttrib;
+                                            rc = rtCrOpenSslConvertPkcs7Attribute((void **)&pOsslAttrib, pAttrib, pErrInfo);
+                                            if (RT_SUCCESS(rc))
+                                            {
+                                                rc = CMS_signed_add1_attr(pSignerInfo, pOsslAttrib);
+                                                rtCrOpenSslFreeConvertedPkcs7Attribute((void **)pOsslAttrib);
+                                                if (rc <= 0)
+                                                    rc = RTErrInfoSet(pErrInfo, VERR_NO_MEMORY, "CMS_signed_add1_attr");
+                                            }
+                                        }
+                                if (RT_SUCCESS(rc))
+                                {
+                                    /* Finally, produce the signed data. */
+                                    rc = CMS_final(pCms, pOsslData, NULL /*dcont*/, fOsslSign);
+                                    if (rc > 0)
                                     {
-                                        rc = CMS_signed_add1_attr(pSignerInfo, pOsslAttrib);
-                                        rtCrOpenSslFreeConvertedPkcs7Attribute((void **)pOsslAttrib);
-                                        if (rc <= 0)
-                                            rc = RTErrInfoSet(pErrInfo, VERR_NO_MEMORY, "CMS_signed_add1_attr");
-                                    }
-                                }
-                            if (RT_SUCCESS(rc))
-                            {
-                                rc = CMS_final(pCms, pOsslData, NULL /*dcont*/, fOsslSign);
-                                if (rc > 0)
-                                {
-                                    /*
-                                     * Get the output and copy it into the result buffer.
-                                     */
-                                    BIO *pOsslResult = BIO_new(BIO_s_mem());
-                                    if (pOsslResult)
-                                    {
-                                        rc = i2d_CMS_bio(pOsslResult, pCms);
-                                        if (rc > 0)
+                                        /*
+                                         * Get the output and copy it into the result buffer.
+                                         */
+                                        BIO *pOsslResult = BIO_new(BIO_s_mem());
+                                        if (pOsslResult)
                                         {
-                                            BUF_MEM *pBuf = NULL;
-                                            rc = (int)BIO_get_mem_ptr(pOsslResult, &pBuf);
+                                            rc = i2d_CMS_bio(pOsslResult, pCms);
                                             if (rc > 0)
                                             {
-                                                AssertPtr(pBuf);
-                                                size_t const cbResult = pBuf->length;
-                                                if (   cbResultBuf >= cbResult
-                                                    && pvResult != NULL)
+                                                BUF_MEM *pBuf = NULL;
+                                                rc = (int)BIO_get_mem_ptr(pOsslResult, &pBuf);
+                                                if (rc > 0)
                                                 {
-                                                    memcpy(pvResult, pBuf->data, cbResult);
-                                                    rc = VINF_SUCCESS;
+                                                    AssertPtr(pBuf);
+                                                    size_t const cbResult = pBuf->length;
+                                                    if (   cbResultBuf >= cbResult
+                                                        && pvResult != NULL)
+                                                    {
+                                                        memcpy(pvResult, pBuf->data, cbResult);
+                                                        rc = VINF_SUCCESS;
+                                                    }
+                                                    else
+                                                        rc = VERR_BUFFER_OVERFLOW;
+                                                    *pcbResult = cbResult;
                                                 }
                                                 else
-                                                    rc = VERR_BUFFER_OVERFLOW;
-                                                *pcbResult = cbResult;
+                                                    rc = RTErrInfoSet(pErrInfo, VERR_GENERAL_FAILURE, "BIO_get_mem_ptr");
                                             }
                                             else
-                                                rc = RTErrInfoSet(pErrInfo, VERR_GENERAL_FAILURE, "BIO_get_mem_ptr");
+                                                rc = RTErrInfoSet(pErrInfo, VERR_GENERAL_FAILURE, "i2d_CMS_bio");
+                                            BIO_free(pOsslResult);
                                         }
                                         else
-                                            rc = RTErrInfoSet(pErrInfo, VERR_GENERAL_FAILURE, "i2d_CMS_bio");
-                                        BIO_free(pOsslResult);
+                                            rc = RTErrInfoSet(pErrInfo, VERR_NO_MEMORY, "BIO_new/BIO_s_mem");
                                     }
                                     else
-                                        rc = RTErrInfoSet(pErrInfo, VERR_NO_MEMORY, "BIO_new/BIO_s_mem");
+                                        rc = RTErrInfoSet(pErrInfo, VERR_GENERAL_FAILURE, "CMS_final");
                                 }
-                                else
-                                    rc = RTErrInfoSet(pErrInfo, VERR_GENERAL_FAILURE, "CMS_final");
                             }
+                            else
+                                rc = RTErrInfoSet(pErrInfo, VERR_GENERAL_FAILURE, "CMS_add1_signer");
                         }
-                        else
-                            rc = RTErrInfoSet(pErrInfo, VERR_GENERAL_FAILURE, "CMS_add1_signer");
                         CMS_ContentInfo_free(pCms);
                     }